# -*- coding: utf-8 -*-
import json
import logging

from darpa_src_parse.enuminfo import JSON_KEY
logger =logging.getLogger()

class JsonParseError(Exception):
    """一个自定义的异常类"""

    def __init__(self, message):
        # 调用内置的Exception类的构造函数
        super().__init__(self)
        # 自定义的错误信息
        self.message = message

    def __str__(self):
        # 当打印异常对象时，返回自定义的错误信息
        return f"ERROR,while parsing json : {self.message}"


class JsonReader:
    '''
    描述: 提供从json文件中提取各种数据的能力
    '''

    @staticmethod
    def _parse_object(line):
        '''
        获取key对应的双引号内的数据
        :param
            line: json一行数据
        :return:
            object: json转化的对象
        '''
        res = json.loads(line)
        return res


    @staticmethod
    def get_base_obj_info(base_obj):
        '''
        从 json 中的 base_obj 中获取信息  host_id, permission, epoch
        base_obj:  每种obj的base_obj对象
        return:  相关的信息
        '''

        host_id = base_obj[JSON_KEY.F_OBJ_HOST_ID]
        permission = base_obj[JSON_KEY.F_OBJ_PERMISSION]
        epoch = base_obj[JSON_KEY.F_OBJ_EPOCH]

        # 描述实体的任意键值对。注意：此属性作为一个临时占位符(CDM18),用于将在下一版本CDM中成为一级属性的项。
        properties = base_obj[JSON_KEY.F_OBJ_PROPERTIES]

        return host_id, permission, epoch


    @staticmethod
    def get_event_info(line):
        '''
        返回事件对应的信息
        事件信息 5 ， subject信息 4， object信息 4，host信息1
        【事件id, 类型，时间，序列，主机id,  subject唯一id, tid, exec, ppid, obj1，obj1_path, obj2，obj2_path】
        [event_uuid, event_type, timestamp_nanos, sequence, host_id,
        subject, thread_id, exec, ppid,
        predicate_object,predicate_object_path,predicate_object2,predicate_object2_path
        ]
        '''

        assert JSON_KEY.F_EVENT in line

        data = JsonReader._parse_object(line)

        # 获取事件
        event_data = data['datum'][JSON_KEY.F_EVENT]
        event_uuid = event_data[JSON_KEY.F_EVENT_UUID]
        sequence = event_data[JSON_KEY.F_EVENT_SEQUENCE][JSON_KEY.F_EVENT_SEQUENCE_LONG]
        event_type = event_data[JSON_KEY.F_EVENT_TYPE]
        thread_id = event_data[JSON_KEY.F_EVENT_THREAD_ID][JSON_KEY.F_EVENT_THREAD_ID_INT]
        host_id = event_data[JSON_KEY.F_EVENT_HOST_ID]
        # EVENT_ADD_OBJECT_ATTRIBUTE 等一些事件没有subject
        subject = None
        if event_data[JSON_KEY.F_EVENT_SUBJECT]!= None:
            subject = event_data[JSON_KEY.F_EVENT_SUBJECT][JSON_KEY.F_EVENT_SUBJECT_UUID]

        predicate_object,predicate_object2 = None,None
        predicate_object_path,predicate_object2_path = None,None
        if event_data[JSON_KEY.F_EVENT_PREDICATE_OBJECT]!=None:
            predicate_object = event_data[JSON_KEY.F_EVENT_PREDICATE_OBJECT][JSON_KEY.F_EVENT_PREDICATE_OBJECT_UUID]

        if event_data[JSON_KEY.F_EVENT_PREDICATE_OBJECT_PATH]!=None:
            predicate_object_path = event_data[JSON_KEY.F_EVENT_PREDICATE_OBJECT_PATH][JSON_KEY.F_EVENT_PATH_STRING]
        if event_data[JSON_KEY.F_EVENT_PREDICATE_OBJECT2]!=None:
            predicate_object2 = event_data[JSON_KEY.F_EVENT_PREDICATE_OBJECT2][JSON_KEY.F_EVENT_PREDICATE_OBJECT_UUID]
        if event_data[JSON_KEY.F_EVENT_PREDICATE_OBJECT2_PATH]!=None:
            predicate_object2_path = event_data[JSON_KEY.F_EVENT_PREDICATE_OBJECT2_PATH][JSON_KEY.F_EVENT_PATH_STRING]
        timestamp_nanos = event_data[JSON_KEY.F_EVENT_TIMESTAMP_NANOS]

        exec, ppid = None, None
        if event_data[JSON_KEY.F_EVENT_PROPERTIES]!=None:
            map = event_data[JSON_KEY.F_EVENT_PROPERTIES][JSON_KEY.F_EVENT_PROPERTIES_MAP]
            if map!={}:
                # cadets
                if JSON_KEY.F_EVENT_MAP_EXEC in map:
                    exec = map[JSON_KEY.F_EVENT_MAP_EXEC]
                    ppid = map[JSON_KEY.F_EVENT_MAP_PPID]


        # 事件信息 5 ， subject信息 4， object信息 4，host信息1
        res = [event_uuid, event_type, timestamp_nanos, sequence, host_id,
               subject, thread_id, exec, ppid,
               predicate_object,predicate_object_path,predicate_object2,predicate_object2_path
               ]

        logger.debug('edge parse',res)

        return res

        # 事件名称
        name = event_data[JSON_KEY.F_EVENT_NAME][JSON_KEY.F_EVENT_NAME_STRING]
        parameters = event_data[JSON_KEY.F_EVENT_PARAMETERS][JSON_KEY.F_EVENT_PARAMETERS_ARRAY]
        # 影响事件的数据的位置
        location = event_data[JSON_KEY.F_EVENT_LOCATION]
        size = event_data[JSON_KEY.F_EVENT_SIZE]
        # 触发事件的程序点
        program_point = event_data[JSON_KEY.F_EVENT_PROGRAM_POINT]
        # return_value = properties[JSON_KEY.F_EVENT_MAP_RETURN]
        # fd = properties[JSON_KEY.F_EVENT_MAP_FD]

    @staticmethod
    def get_principal_info(line):
        '''
        获取 principal 对象信息
        【用户唯一id， 类型， uid , 用户名， gid, 主机id】
        [principal_uuid, principal_type, user_id, username, group_ids, host_id]
        '''
        assert JSON_KEY.F_PRINCIPAL in line

        # 将 JSON 转换为 Python 对象
        data = json.loads(line)

        # 使用字段名获取对应的值
        principal_data = data['datum'][JSON_KEY.F_PRINCIPAL]
        principal_uuid = principal_data[JSON_KEY.F_PRINCIPAL_UUID]
        principal_type = principal_data[JSON_KEY.F_PRINCIPAL_TYPE]
        host_id = principal_data[JSON_KEY.F_PRINCIPAL_HOST_ID]
        user_id = principal_data[JSON_KEY.F_PRINCIPAL_USER_ID]
        try:
            username = principal_data[JSON_KEY.F_PRINCIPAL_USERNAME][JSON_KEY.F_PRINCIPAL_USERNAME_STRING]
        except:
            username = None
        try:
            group_ids = principal_data[JSON_KEY.F_PRINCIPAL_GROUP_IDS]
        except:
            group_ids = None

        # 暂时无用
        try:
            properties = principal_data[JSON_KEY.F_PRINCIPAL_PROPERTIES]
            properties_map = properties[JSON_KEY.F_PRINCIPAL_PROPERTIES_MAP]
        except:
            PROPERTIES_MAP = None

        res = [principal_uuid, principal_type, user_id, username, group_ids, host_id]

        logger.debug('principal parse',res)

        return res

    @staticmethod
    def get_host_info(line):
        '''

        返回 host 对应的信息
        【主机id, 主机名， 主机类型， 接口名[]，接口mac[], 接口ip[]】
        list [uuid, host_name, host_type, interfaces_name, interfaces_mac, interfaces_ip]
        '''

        assert JSON_KEY.F_HOST in line

        # 将 JSON 转换为 Python 对象
        data = json.loads(line)

        # 使用字段名获取对应的值
        host_data = data['datum'][JSON_KEY.F_HOST]
        uuid = host_data[JSON_KEY.F_HOST_UUID]
        host_name = host_data[JSON_KEY.F_HOST_HOST_NAME]
        host_type = host_data[JSON_KEY.F_HOST_HOST_TYPE]
        interfaces = host_data[JSON_KEY.F_HOST_INTERFACES]

        interfaces_name = []
        interfaces_mac = []
        interfaces_ip = []   # 只保留ipv4

        if interfaces is not None:
            for interface in interfaces:
                interface_name = interface[JSON_KEY.F_INTERFACE_NAME]
                mac_address = interface[JSON_KEY.F_INTERFACE_MAC_ADDRESS]
                # cadets的ipv4在第2个， theia的ipv6在第一个。
                if interface[JSON_KEY.F_INTERFACE_IP_ADDRESSES] == []:
                    return None
                try:
                    # cadets 数据集
                    ip_addresses = interface[JSON_KEY.F_INTERFACE_IP_ADDRESSES][1]
                except:
                    # theia 数据集
                    ip_addresses = interface[JSON_KEY.F_INTERFACE_IP_ADDRESSES][0]
                interfaces_name.append(interface_name)
                interfaces_mac.append(mac_address)
                interfaces_ip.append(ip_addresses)

        res = [uuid, host_name, host_type, interfaces_name, interfaces_mac, interfaces_ip]

        logger.debug('host parse:',res)

        return res


    @staticmethod
    def get_subject_info(line):
        '''
        获取subject信息
        【subject唯一id, 类型， 线程id, 命令行， 开始时间， 父进程唯一id, 主机id， 本地用户， 导入库， 导出库】
        [subject_uuid, subject_type, cid, cmd_line, start_timestamp_nanos, parent_subject,
               host_id, local_principal,
               imported_libraries, exported_libraries]
        '''
        assert  JSON_KEY.F_SUBJECT in line

        # 将 JSON 转换为 Python 对象
        data = json.loads(line)

        # 使用字段名获取对应的值
        subject_data = data['datum'][JSON_KEY.F_SUBJECT]
        subject_uuid = subject_data[JSON_KEY.F_SUBJECT_UUID]
        subject_type = subject_data[JSON_KEY.F_SUBJECT_TYPE]
        cid = subject_data[JSON_KEY.F_SUBJECT_CID]
        parent_subject = None
        if subject_data[JSON_KEY.F_SUBJECT_PARENT_SUBJECT]!=None:
            parent_subject = subject_data[JSON_KEY.F_SUBJECT_PARENT_SUBJECT][JSON_KEY.F_SUBJECT_PARENT_UUID]

        host_id = subject_data[JSON_KEY.F_SUBJECT_HOST_ID]
        local_principal = subject_data[JSON_KEY.F_SUBJECT_LOCAL_PRINCIPAL]
        start_timestamp_nanos = subject_data[JSON_KEY.F_SUBJECT_START_TIMESTAMP_NANOS]

        cmd_line = subject_data[JSON_KEY.F_SUBJECT_CMD_LINE]

        imported_libraries = subject_data[JSON_KEY.F_SUBJECT_IMPORTED_LIBRARIES]
        exported_libraries = subject_data[JSON_KEY.F_SUBJECT_EXPORTED_LIBRARIES]

        res = [subject_uuid, subject_type, cid, cmd_line, start_timestamp_nanos, parent_subject,
               host_id, local_principal,
               imported_libraries, exported_libraries]

        logger.debug('subject parse:',res)

        return res

        # 单元相关，不需要
        unit_id = subject_data[JSON_KEY.F_SUBJECT_UNIT_ID]
        iteration = subject_data[JSON_KEY.F_SUBJECT_ITERATION]
        count = subject_data[JSON_KEY.F_SUBJECT_COUNT]

        # Windows允许进程具有不同的特权级别
        privilege_level = subject_data[JSON_KEY.F_SUBJECT_PRIVILEGE_LEVEL]

        # 暂时不用这些数据
        properties = subject_data[JSON_KEY.F_SUBJECT_PROPERTIES]
        properties_map = properties[JSON_KEY.F_SUBJECT_PROPERTIES_MAP]


    @staticmethod
    def get_file_info(line):
        '''
        获取file_object对象信息
        【文件id, 文件类型, 权限， epoch ,主机id】
        [file_uuid, file_type, permission, epoch, host_id]


        '''
        assert JSON_KEY.F_FILE in line

        # 将 JSON 转换为 Python 对象
        data = json.loads(line)

        file_data = data['datum'][JSON_KEY.F_FILE]

        file_uuid = file_data[JSON_KEY.F_FILE_UUID]
        base_object = file_data[JSON_KEY.F_OBJ_BASE_OBJECT]
        host_id, permission, epoch = JsonReader.get_base_obj_info(base_object)
        file_type = file_data[JSON_KEY.F_FILE_TYPE]

        # 不重要字段。先省略
        file_descriptor = file_data[JSON_KEY.F_FILE_DESCRIPTOR]
        local_principal = file_data[JSON_KEY.F_FILE_LOCAL_PRINCIPAL]
        size = file_data[JSON_KEY.F_FILE_SIZE]
        pe_info = file_data[JSON_KEY.F_FILE_PE_INFO]
        hashes = file_data[JSON_KEY.F_FILE_HASHES]

        res = [file_uuid, file_type, permission, epoch, host_id]

        logger.debug('file parse:',res)

        return res


    @staticmethod
    def get_srcsink_info(line):
        '''
        返回 srcsink 对应的信息
        【唯一id， 节点类型， 权限， epoch , 主机id】
        res = [srcsink_uuid, srcsink_type, permission, epoch, host_id]
        '''

        assert JSON_KEY.F_SRCSINK in line

        # 将 JSON 转换为 Python 对象
        data = json.loads(line)

        # 使用字段名获取对应的值
        srcsink_data = data['datum'][JSON_KEY.F_SRCSINK]
        srcsink_uuid = srcsink_data[JSON_KEY.F_SRCSINK_OBJECT_UUID]
        base_object = srcsink_data[JSON_KEY.F_SRCSINK_OBJECT_BASE]
        host_id = base_object[JSON_KEY.F_SRCSINK_OBJECT_HOST_ID]
        permission = base_object[JSON_KEY.F_SRCSINK_OBJECT_PERMISSION]
        epoch = base_object[JSON_KEY.F_SRCSINK_OBJECT_EPOCH]
        properties = base_object[JSON_KEY.F_SRCSINK_OBJECT_PROPERTIES]
        try:
            properties_map = properties[JSON_KEY.F_SRCSINK_OBJECT_PROPERTIES_MAP]
        except:
            properties_map = None
        srcsink_type = srcsink_data[JSON_KEY.F_SRCSINK_OBJECT_TYPE]
        file_descriptor = srcsink_data[JSON_KEY.F_SRCSINK_OBJECT_FILE_DESCRIPTOR]


        res = [srcsink_uuid, srcsink_type, permission, epoch, host_id]

        logger.debug('srcsink parse',res)

        return res

    @staticmethod
    def get_unnamedpipe_info(line):
        '''
        返回 unnamedpipe 对应的信息
        【唯一id， 来源节点， 汇聚节点, 主机id，权限，epoch】
        [unnamedpipe_uuid, source_uuid, sink_uuid, host_id, permission, epoch]
        '''

        assert JSON_KEY.F_UNNAMEDPIPE in line

        # 将 JSON 转换为 Python 对象
        data = json.loads(line)

        unnamedpipe = data['datum'][JSON_KEY.F_UNNAMEDPIPE]
        unnamedpipe_uuid = unnamedpipe[JSON_KEY.F_UNNAMEDPIPE_UUID]
        base_object = unnamedpipe[JSON_KEY.F_UNNAMEDPIPE_BASE]
        host_id, permission , epoch = JsonReader.get_base_obj_info(base_object)
        try:
            properties = base_object[JSON_KEY.F_UNNAMEDPIPE_PROPERTIES]
            properties_map = properties[JSON_KEY.F_UNNAMEDPIPE_PROPERTIES_MAP]
        except:
            properties_map = None

        source_fd = unnamedpipe[JSON_KEY.F_UNNAMEDPIPE_SOURCE_FD]
        sink_fd = unnamedpipe[JSON_KEY.F_UNNAMEDPIPE_SINK_FD]
        source_uuid = unnamedpipe[JSON_KEY.F_UNNAMEDPIPE_SOURCE_UUID][JSON_KEY.F_UUID_VAL]
        sink_uuid = unnamedpipe[JSON_KEY.F_UNNAMEDPIPE_SINK_UUID][JSON_KEY.F_UUID_VAL]


        res = [unnamedpipe_uuid, source_uuid, sink_uuid, host_id, permission, epoch]

        logger.debug('unnamedpipe parse', res)

        return res

    @staticmethod
    def get_registry_info(line):
        """ 专用于windows
        返回注册键值对的信息
        uuid, 键位置， 值的类型， 主机id
        """
        assert JSON_KEY.F_RegistryKeyObject in line
        # 将 JSON 转换为 Python 对象
        data = json.loads(line)
        # 使用字段名获取对应的值
        registry_data = data['datum'][JSON_KEY.F_RegistryKeyObject]

        reg_uuid = registry_data[JSON_KEY.F_RegistryKeyObject_UUID]
        registry_key  = registry_data[JSON_KEY.F_RegistryKeyObject_KEY]

        base_object = registry_data[JSON_KEY.F_RegistryKeyObject_BASE]
        host_id = base_object[JSON_KEY.F_RegistryKeyObject_HOST_ID]
        permission = base_object[JSON_KEY.F_RegistryKeyObject_PERM]
        epoch = base_object[JSON_KEY.F_RegistryKeyObject_EPOCH]
        properties = base_object[JSON_KEY.F_RegistryKeyObject_PROP]

        try:
            reg_v_type = registry_data[JSON_KEY.F_RegistryKeyObject_V][JSON_KEY.F_RegistryKeyObject_VALUE][JSON_KEY.F_RegistryKeyObject_VALUE_DATATYPE]
        except:
            reg_v_type = None

        res = [reg_uuid,registry_key,reg_v_type,host_id]
        logger.debug('netflow parse', res)

        return res







    @staticmethod
    def get_netflow_info(line):
        '''
        返回  netflow 对应的信息
        【唯一id， 本地IP，port, 远程IP,port 协议类型， 主机id 】
        [netflow_uuid, local_address, local_port, remote_address, remote_port, ip_protocol ,host_id]
        '''
        assert  JSON_KEY.F_NETFLOW in line

        # 将 JSON 转换为 Python 对象
        data = json.loads(line)

        # 使用字段名获取对应的值
        netflow_data = data['datum'][JSON_KEY.F_NETFLOW]
        netflow_uuid = netflow_data[JSON_KEY.F_NETFLOW_UUID]
        base_object = netflow_data[JSON_KEY.F_NETFLOW_BASE]
        host_id = base_object[JSON_KEY.F_NETFLOW_HOST_ID]
        permission = base_object[JSON_KEY.F_NETFLOW_PERMISSION]
        epoch = base_object[JSON_KEY.F_NETFLOW_EPOCH]
        properties = base_object[JSON_KEY.F_NETFLOW_PROPERTIES]
        if properties!=None:
            try:
                properties_map = properties[JSON_KEY.F_NETFLOW_PROPERTIES_MAP]
            except:
                properties_map = None
        local_address = netflow_data[JSON_KEY.F_NETFLOW_LOCAL_ADDRESS]
        local_port = netflow_data[JSON_KEY.F_NETFLOW_LOCAL_PORT]
        remote_address = netflow_data[JSON_KEY.F_NETFLOW_REMOTE_ADDRESS]
        remote_port = netflow_data[JSON_KEY.F_NETFLOW_REMOTE_PORT]
        ip_protocol = netflow_data[JSON_KEY.F_NETFLOW_IP_PROTOCOL]
        file_descriptor = netflow_data[JSON_KEY.F_NETFLOW_FILE_DESCRIPTOR]

        res = [netflow_uuid, local_address, local_port, remote_address, remote_port, ip_protocol ,host_id]

        logger.debug('netflow parse', res)

        return res


    @staticmethod
    def get_demo_info(line):
        '''
        返回   对应的信息
        【唯一id， 】
        '''

        res = []

        print('demo parse', res)

        return res



class ProcenanceInf:
    '''
    存储溯源信息。
    '''

    vertex = {}
    edge = {}
    host = {}
    principal = {}

    @staticmethod
    def clear_data():
        ProcenanceInf.vertex = {}
        ProcenanceInf.edge = {}
        ProcenanceInf.host = {}
        ProcenanceInf.principal = {}

    @staticmethod
    def store_host_info(info):
        # 【主机id, 主机名， 主机类型， 接口名[]，接口mac[], 接口ip[]】
        ProcenanceInf.host[info[0]] = {
            'host_name' : info[1],
            'host_type' : info[2],
            'host_ip'   : info[5]
        }
        return None

    @staticmethod
    def store_principal_info(info):
        # 【用户唯一id， 类型， uid , 用户名， gid, 主机id】
        ProcenanceInf.principal[info[0]] = {
            'user_name': info[3],
            'user_id': info[2],
            'user_type': info[1],
        }

        if info[5] != None and ProcenanceInf.host.get(info[5], None) != None and ProcenanceInf.host[info[5]].get('host_name', None) != None:
            ProcenanceInf.principal[info[0]].update({'host_name': info[5]})

        if info[4]!= []:
            ProcenanceInf.principal[info[0]].update({'user_gid' :info[4]})
        return None


    @staticmethod
    def update_vertex_info(uuid, attrs):
        '''
        向uuid对应的vertex,添加节点信息attrs(字典形式)。
        '''

        if uuid not in ProcenanceInf.vertex:
            ProcenanceInf.vertex[uuid] = {}

        ProcenanceInf.vertex[uuid].update(attrs)


    @staticmethod
    def store_vertex(src, info):
        '''
        从json信息中提取溯源信息，存储为节点。
        :param src:  信息来源
        :param info:  json提取的信息
        host        【主机id, 主机名， 主机类型， 接口名[]，接口mac[], 接口ip[]】
        principal   【用户唯一id， 类型， uid , 用户名， gid, 主机id】

        event       【事件id, 类型，时间，序列，主机id,       subject唯一id, tid, exec, ppid,         obj1，obj1_path, obj2，obj2_path】
        subject     【subject唯一id, 类型， 线程id, 命令行， 开始时间， 父进程唯一id, 主机id， 本地用户， 导入库， 导出库】
        file        【文件id, 文件类型, permission， epoch ,主机id】
        netflow     【netflow唯一id， 本地IP，port, 远程IP,port 协议类型， 主机id 】
        srcsink     [srcsink_uuid, srcsink_type, permission, epoch, host_id]
        unnamedpipe [unnamedpipe_uuid, source_uuid, sink_uuid, host_id, permission, epoch]
        '''
        if src == 'file':
            uuid = info[0]
            attrs = {
                'type': info[1],
            }
            if info[2]!=None:
                attrs.update({'permission':info[2]})
            ProcenanceInf.update_vertex_info(uuid, attrs)

        if src == 'netflow':
            uuid = info[0]
            attrs = {
                'type': 'netflow',
                'local_ip': info[1],
                'local_port': info[2],
                'remote_ip': info[3],
                'remote_port': info[4],
            }
            if info[5]!=None:
                attrs.update({'protocol': info[5]})
            ProcenanceInf.update_vertex_info(uuid, attrs)

        if src == 'subject':
            # subject     【subject唯一id, 类型， 线程id, 命令行， 开始时间 4， 父进程唯一id, 主机id， 本地用户， 导入库， 导出库】
            uuid = info[0]
            attrs = {
                'type': info[1],
                'pid': info[2],
            }
            if info[3]!=None:
                attrs.update({'commLine':info[3]})
            if info[5]!=None:
                attrs.update({'p_uuid':info[5]})

            if info[6]!=None and ProcenanceInf.host.get(info[6], None)!=None and ProcenanceInf.host[info[6]].get('host_name', None)!=None:
                attrs.update({'host_name': ProcenanceInf.host[info[6]].get('host_name')})

            if info[7]!=None and ProcenanceInf.principal.get(info[7], None)!=None and ProcenanceInf.principal[info[7]].get('user_name', None)!=None:
                attrs.update({'user_name': ProcenanceInf.principal[info[7]].get('user_name')})
            ProcenanceInf.update_vertex_info(uuid, attrs)

        if src == 'event':
            # 【事件id, 类型，时间，序列，主机id,       <5>subject唯一id, tid, exec, ppid,         <9>obj1，obj1_path, obj2，obj2_path】
            if info[5]!=None:
                uuid = info[5]
                attrs = {}
                if info[6]!=None:
                    attrs['tid'] = info[6]
                if info[7] != None:
                    attrs['exec'] = info[7]
                if info[8] != None:
                    attrs['ppid'] = info[8]
                ProcenanceInf.update_vertex_info(uuid, attrs)
            if info[9]!=None and info[10]!=None and info[10] != '<unknown>':
                uuid = info[9]
                # 路径可能有多种情况,定义为集合
                if uuid not in ProcenanceInf.vertex:
                    ProcenanceInf.vertex[uuid] = {}
                if ProcenanceInf.vertex[uuid].get('path', None)==None:
                    ProcenanceInf.vertex[uuid]['path']=[]
                if info[10] not in ProcenanceInf.vertex[uuid]['path']:
                    ProcenanceInf.vertex[uuid]['path'].append(info[10])

            if info[11]!=None and info[12]!=None and info[12] != '<unknown>':
                uuid = info[11]
                # 路径可能有多种情况,定义为集合
                if uuid not in ProcenanceInf.vertex:
                    ProcenanceInf.vertex[uuid] = {}
                if ProcenanceInf.vertex[uuid].get('path', None) == None:
                    ProcenanceInf.vertex[uuid]['path'] = []
                if info[12] not in ProcenanceInf.vertex[uuid]['path']:
                    ProcenanceInf.vertex[uuid]['path'].append(info[12])


        if src == 'srcsink':
            # srcsink[srcsink_uuid, srcsink_type, permission, epoch, host_id]
            # unnamedpipe[unnamedpipe_uuid, source_uuid, sink_uuid, host_id, permission, epoch]
            uuid = info[0]
            attrs = {
                'type':info[1]
            }
            if info[2] != None:
                attrs.update({'permission': info[2]})
            ProcenanceInf.update_vertex_info(uuid, attrs)

        if src == 'registry':
            # uuid, 键位置， 值的类型， 主机id
            uuid = info[0]
            attrs = {
                'type': 'registry',
                'key': info[1]
            }
            if info[2] != None:
                attrs.update({ 'value_type': info[2]})

            ProcenanceInf.update_vertex_info(uuid, attrs)

        if src == 'unnamedpipe':
            # [unnamedpipe_uuid, source_uuid, sink_uuid, host_id, permission, epoch]
            uuid = info[0]
            attrs = {
                'type': 'unnamedpipe'
            }
            if info[1]!=None and info[2]!=None:
                attrs.update({'src_uuid':info[1],'dst_uuid':info[2]})
            if info[4] != None:
                attrs.update({'permission': info[4]})
            ProcenanceInf.update_vertex_info(uuid, attrs)